Merge branch 'net-prevent-lockless-data-races-in-net_device-tc-structures'

Eric Dumazet says:

====================
net: prevent lockless data races in net_device TC structures

This patch series resolves lockless data races between fast-path packet
processing / qdisc schedulers (e.g. taprio advance_sched(), XPS queue
lookups, skb_tx_hash()) and control-path updates modifying traffic class
configurations on a net_device.

syzbot / KCSAN reported a data-race between advance_sched() reading
dev->num_tc in netdev_get_num_tc() and control-path updates writing
dev->num_tc in netdev_set_num_tc():
  ==================================================================
  BUG: KCSAN: data-race in advance_sched / netdev_set_num_tc
  write to 0xffff88811ac5c036 of 2 bytes by task 4434 on cpu 0:
    netdev_set_num_tc+0x... net/core/dev.c:3158
    ...
    tc_modify_qdisc+0x102a/0x1550 net/sched/sch_api.c:1844
    rtnetlink_rcv_msg+0x6a7/0x720 net/core/rtnetlink.c:7085
  read to 0xffff88811ac5c036 of 2 bytes by interrupt on cpu 1:
    netdev_get_num_tc include/linux/netdevice.h:2684 [inline]
    taprio_set_budgets net/sched/sch_taprio.c:667 [inline]
    advance_sched+0x58f/0x730 net/sched/sch_taprio.c:984
    __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
    __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2096
  value changed: 0x0000 -> 0x0001
  ==================================================================

Further inspection of the TC metadata structures on struct net_device
revealed three separate issues under concurrent lockless access:

1. struct netdev_tc_txq holds adjacent 16-bit offset and count fields
   that are written separately in netdev_set_tc_queue() (and cleared
   via memset() during reset), allowing lockless readers in fast-path
   helpers and drivers to observe torn/inconsistent states. This is fixed
   in Patch 1 by wrapping count and offset in a union with a u32
   combined field manipulated atomically via READ_ONCE()/WRITE_ONCE().

2. dev->num_tc is read locklessly in fast-path lookups and timer
   interrupts without READ_ONCE() annotations, while control paths modify
   it using plain writes. Patch 2 adds READ_ONCE()/WRITE_ONCE()
   annotations across core networking code and drivers.

3. dev->prio_tc_map is similarly read locklessly in fast-path helpers
   such as skb_tx_hash() while control paths update entries or clear the
   map via memset(). Patch 3 adds READ_ONCE()/WRITE_ONCE() annotations
   to netdev_get_prio_tc_map() and netdev_set_prio_tc_map() and replaces
   memset() with explicit atomic store loops.

Reported-by: syzbot+a181d44496a497911353@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a7c3457.d5f0ebe7.22d851.000a.GAE@google.com/T/#u
====================

Link: https://patch.msgid.link/20260812085440.3917924-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

0 files changed, 0 insertions, 0 deletions